Tp-link Archer C2 OS Command Injection Vulnerability

TP-Link Archer C2 is a wireless router from Tp-link.TP-Link Archer C20i version 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n is vulnerable due to a security flaw in the device’s HTTP parameter X_TP_ ExternalIPv6Address. ExternalIPv6Address in the device lacks filtering and escaping of user data, which can be exploited by remote attackers to run arbitrary commands on the router with root privileges.